In the past two weeks I set up a new VPS, and I run a small experiment. I share the results for those who are curious.
Consider that this is a backup server only, meaning that there is no outgoing traffic unless a backup is actually to be recovered, or as we will see, because of sshd.
I initially left the standard "port 22 open to the world" for 4-5 days, I then moved sshd to a different port (still open to the whole world), and finally I closed everything and turned on tailscale. You find a visualization of the resulting egress traffic in the image. Different colors are different areas of the world. Ignore the orange spikes which were my own ssh connections to set up stuff.
Main points:
-
there were about 10 Mb of egress per day due just to sshd answering to scanners. Not to mention the cluttering of access logs.
-
moving to a non standard port is reasonably sufficient to avoid traffic and log cluttering even without IP restrictions
-
Tailscale causes a bit of traffic, negligible of course, but continuous.
It is and it isn't. It prevents random scans from opening 22 and attempting to authenticate, that's basically the entire purpose. You still need good authentication after because you're right, it's not a security measure, it's just a way to keep your logs useful and to keep botnets from beating the hell out of 22.
By "good authentication" I mean a key pair based authentication. That is impossible to brute force. If you use a password on 22 you shouldn't open it at all and you should rethink allowing any remote access.
Put another way: You're the doorman at a speak easy. You can answer the little window with "what's the password?" to every jack ass that approaches, and you'd be asking all the time. But if they don't know they have to knock "shave and a haircut" first, your job gets a lot easier and you're dealing with a lot fewer nuisance password promptings.
You can also use it to blacklist. If someone tries to hit 22 without knocking you can blacklist that IP entirely because you know it's nuisance.
When you put it that way, it sounds beneficial and like something I’d like to use. Thank you!
The article may have been dissing it as a sole strategy.
It's not uncommon for people to try using it as their sole authentication so that wouldn't be a surprise. But for it's purpose, it's perfect.
Very good explanation. And the benefits are even greater: because there is absolutely no response until the entire secret knock is correctly used, the random guy trying to get in doesn’t even know if there’s anyone at that address. (In fact, set up correctly, they won’t even know if there’s really a door there or not)